Microsoft 365 Copilot
Connect Microsoft 365 Copilot to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Microsoft 365 Copilot to record its access review and data terms as attested evidence. Microsoft 365 Copilot offers no admin API for automated tests.
| Category | Business Applications |
| Connect with | API token |
| What a connection produces | Attested evidence |
Connect with an API token
-
In Microsoft 365 Copilot:
- Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator.
- Browse to Entra ID › App registrations, select New registration, name the app, choose Accounts in this organizational directory only, and select Register.
- Select Certificates & secrets › Client secrets › New client secret, enter a description and duration, select Add, and copy the value (shown only once).
- In the app registration, select API permissions › Add a permission › Microsoft Graph › Application permissions, select Reports.Read.All (the permission the Microsoft 365 Copilot usage report APIs require), then Add permissions.
- Select Grant admin consent for {your tenant}; the Microsoft Entra tenant administrator must explicitly grant consent.
Microsoft 365 Copilot shows the secret only once, so copy it before you leave the page.
Microsoft 365 Copilot's public documentation does not cover every step.
Source: learn.microsoft.com, learn.microsoft.com, learn.microsoft.com, learn.microsoft.com, checked 2026-10-07.
-
On Compliance › Connectors, open Microsoft 365 Copilot, click Connect, choose API token and fill in:
Field What to enter API token / Personal access token Required. Stored encrypted and never shown again. Base URL (optional) — Account / Org / Workspace (optional) — -
Click Connect with token.
Frameworks
Microsoft 365 Copilot publishes no API for what these tests check, so its evidence is an attestation: connect it to record the connection, then attest the result. An accepted attestation counts toward each control below.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Attestation | C1.2, CC6.2, CC6.3, CC6.5 | 2 |
| ISO/IEC 27001 | Attestation | A.5.18, A.5.34, A.8.10 | 2 |
| HIPAA Security Rule | Attestation | 164.308(a)(3) | 1 |
| PCI DSS | Attestation | 7.2.4 | 1 |
| NIST CSF 2.0 | Attestation | GV.OC-03, PR.AA-05 | 2 |
These tests are switched on per workspace by the Safeguard team.
Related
- Business Applications connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks